--- title: "Security Update: Node.js Vulnerability (CVE-2026-111497)" url: https://docs.catalyst.zoho.com/en/announcements/2026/node-security-update/ description: "Catalyst has updated its managed Node.js runtimes to fix CVE-2026-111497. Redeploy your Node.js Functions, AppSail services and Slate apps, and move off Node.js versions earlier than 22." last_updated: 2026-10-26T07:06:56Z service: All Services type: general related_links: - name: "Language Runtime Support Policy" url: /en/serverless/help/functions/runtime-support/ - name: "Update a Function" url: /en/serverless/help/functions/implementation/#update-or-download-a-function - name: "AppSail Deployments" url: /en/serverless/help/appsail/console/deployments/ - name: "Slate Deployments" url: /en/slate/help/monitor-deployment/ - name: "Release Notes" url: /en/release-notes/all/ --- # Security Update (CVE-2026-111497): Fixed Node.js Vulnerability We want to make you aware that on **October 21, 2026**, the Node.js project released security updates for a high-severity vulnerability, [CVE-2026-111497](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases), in the Brotli decompression library that ships with Node.js. If an application decompresses Brotli data crafted by an attacker, the attacker may be able to corrupt the application's memory and run their own code inside it. This vulnerability affects every application running on an unpatched version of Node.js, including all end-of-life versions such as Node.js 20 and older. It is not specific to Catalyst by Zoho. ### How we've patched it We have updated Catalyst's managed Node.js runtimes to the patched versions:
Runtime Patched Version
Node.js 24 24.22.1
Node.js 22 22.23.4
This fix applies to Catalyst [Functions](https://docs.catalyst.zoho.com/en/serverless/help/functions/introduction/), AppSail ([Catalyst-managed runtimes](https://docs.catalyst.zoho.com/en/serverless/help/appsail/catalyst-managed-runtimes/key-concepts/)), [Slate](https://docs.catalyst.zoho.com/en/slate/help/introduction/) builds, and the default image used by Catalyst [Pipelines](https://docs.catalyst.zoho.com/en/pipelines/help/pipelines/introduction/), which now runs **Node.js 24**. Catalyst by Zoho has applied these security patches only to Catalyst-managed runtimes that have not reached end-of-life, as described in the [Language Runtime Support Policy](https://docs.catalyst.zoho.com/en/serverless/help/functions/runtime-support/). Runtimes that have reached end-of-life and [custom runtimes](https://docs.catalyst.zoho.com/en/serverless/help/appsail/custom-runtimes/deploy-from-console/) do not receive these patches. If you are on an end-of-life runtime, upgrade to a supported runtime and redeploy your application. The patches will be applied automatically. Since custom runtimes run your own container images, you need to apply the patches yourself. ### What you need to do #### Check the runtime of your application To confirm the Node.js version your Function or AppSail service is using, log `process.version` from within it. If the version is earlier than `v22.23.4` on Node.js 22, or earlier than `v24.22.1` on Node.js 24, perform the applicable actions below. #### 1. Redeploy Your Node.js Functions, AppSail Services and Slate Applications If your application is already running or was built before this security update, it continues to use the earlier version. Redeploy your application to pick up the patched version. **Using the Catalyst console:** * **Functions:** Go to **Serverless** → **Functions**, open your function, click the **⋯** icon at the top right, then **Update**, and click **Save**. Learn more about [updating a function](https://docs.catalyst.zoho.com/en/serverless/help/functions/implementation/#update-or-download-a-function). ![Functions - Update a Function](https://docs.catalyst.zoho.com/images/announcements/node-security-update/catalyst_node_security_functions_update.webp) * **AppSail:** Go to **Serverless** → **AppSail**, open your service, and click **Create Deployment**. Keep your current **Stack**, upload your app's build file (ZIP) under **Build File**, and click **Create**. Learn more about [creating a new deployment](https://docs.catalyst.zoho.com/en/serverless/help/appsail/console/deployments/#create-a-new-deployment). ![AppSail - Create Deployment](https://docs.catalyst.zoho.com/images/announcements/node-security-update/catalyst_node_security_appsail_create_deployment.webp) ![AppSail - Create Deployment pop-up](https://docs.catalyst.zoho.com/images/announcements/node-security-update/catalyst_node_security_appsail_create_deployment_2.webp) * **Slate:** Go to **Slate** and click your app to expand it, then click **App Settings**. Expand **Framework and command**, click **Edit**, select **Node 22** from the runtime drop-down, and click **Update**. Learn more about [updating the Node.js runtime of an app](https://docs.catalyst.zoho.com/en/slate/help/monitor-deployment/#update-the-nodejs-runtime-of-an-app). Changing the runtime doesn't rebuild your app, so redeploy it: ![Slate - App Settings](https://docs.catalyst.zoho.com/images/announcements/node-security-update/catalyst_node_security_slate_app_settings.webp) ![Slate - Select the Node.js runtime](https://docs.catalyst.zoho.com/images/announcements/node-security-update/catalyst_node_security_slate_runtime.webp) * **Git-connected apps:** Click **Create Deployment**, or push a new commit to your repository. With Auto Deploy on, it deploys automatically. * **Uploaded apps:** Click [Re-Upload](https://docs.catalyst.zoho.com/en/slate/help/direct-upload/#re-upload-application) on the app's **Overview** screen and upload your app. ![Slate - Re-Upload](https://docs.catalyst.zoho.com/images/announcements/node-security-update/catalyst_node_security_slate_reupload.webp) > **Note:** Prioritize **Next.js** apps on Slate, since they run Node.js while serving requests. Static apps (React, Vue, Angular and similar) use Node.js only during the build. **Using the CLI:** Run `catalyst deploy` from your project directory. This deploys Functions, AppSail and Slate together. To deploy only Slate, run `catalyst deploy slate`. Learn more about [deploy options](https://docs.catalyst.zoho.com/en/cli/v1/deploy-resources/deploy-options/) and [deploying to Slate](https://docs.catalyst.zoho.com/en/cli/v1/deploy-resources/deploy-to-slate/). #### 2. Move Off Node.js Versions Earlier Than 22 Node.js 20 reached [end-of-life](https://nodejs.org/en/about/previous-releases) on April 30, 2026, and the Node.js project isn't releasing a fix for it. Catalyst won't patch any Node.js runtime earlier than Node.js 22 (Node.js 20, 18, 16 and older). See the [Node.js runtime deprecations](https://docs.catalyst.zoho.com/en/serverless/help/functions/runtime-support/#nodejs-runtime-deprecations) for the timeline. If your Functions, AppSail services or Slate apps use any of these versions, update them to a supported version: Node.js 22 or 24 for Functions and AppSail, and Node.js 22 for Slate. **Using the Catalyst console:** * **Functions:** Use **⋯** → **Update**, select the new runtime version from the **Stack** drop-down, and click **Save**. ![Functions - Select the Node.js runtime](https://docs.catalyst.zoho.com/images/announcements/node-security-update/catalyst_node_security_functions_stack.webp) * **AppSail:** Open your service, click **Create Deployment**, select **Node 24** or **Node 22** from the **Stack** drop-down, upload your build file, and click **Create**. * **Slate:** Follow the Slate steps in step 1, select **Node 22**, and redeploy your app. **Using the CLI:** Change the `stack` value in your function's [catalyst-config.json](https://docs.catalyst.zoho.com/en/serverless/help/functions/stack/) or your service's [app-config.json](https://docs.catalyst.zoho.com/en/serverless/help/appsail/catalyst-managed-runtimes/deploy-from-cli/) (for example, `node24`), then test your app and run `catalyst deploy`. #### 3. Rebuild Custom Containers If you deploy your own Docker or OCI image to [AppSail](https://docs.catalyst.zoho.com/en/serverless/help/appsail/custom-runtimes/deploy-from-console/), rebuild it on a patched Node.js base image and redeploy. #### 4. Check Your Catalyst Pipelines If your pipelines use the default image, no action is needed. It now runs a patched version of Node.js 24 (previously Node.js 18). If you specify your own [image](https://docs.catalyst.zoho.com/en/pipelines/help/catalyst-pipelines.yaml/build-the-pipeline/images/) in `catalyst-pipelines.yaml` (for example, `image: node:20`), update it to a patched Node.js image such as `node:24` or `node:22`, and run your pipeline again. #### 5. Update Node.js on Your Machine The Catalyst CLI and your local builds use the Node.js installed on your computer and in your CI pipelines. Update it to Node.js 22.23.4, 24.22.1 or later. You can check your current version with: ```bash node -v ``` > **Note:** With regards to the **eMudhra (emSign) Certificate** issue You would have come across reports that browsers are withdrawing trust from certain certificates issued by eMudhra (emSign). Catalyst by Zoho is not affected by this compromise, and no action is needed for your Catalyst domains. This applies to apps in every language, not only Node.js. We've updated the trusted certificate lists in Catalyst's Node.js, Java, and Python runtimes, and **redeploying your apps** will pick up these updates. If you bundle your own certificate store or dependencies, for example, a custom AppSail container, a JDK, or the Python certificate package, ensure you've updated them to the latest versions. If you have any questions or need help upgrading, reach out to us at **support@zohocatalyst.com**.